HeroDevs
Visit NES for Apache Struts Home Page

NES for Apache Struts Forward Compatibility 1.3 1.4.x Release Notes

6 versions

Comprehensive release notes and changelog for NES for Apache Struts Forward Compatibility 1.3 1.4.x, including security patches, bug fixes, and feature updates across all supported versions.

Sep 17, 2026
Latest: 1.4.5
3 Patched Vulnerabilities
VEX Statements

September 2026

1.4.5

Released Sep 17, 2026
Full Version: 
1.3.10-struts-1.4.5

Notes

  • struts-core now tolerates a request that specifies no character encoding when handling multipart/form-data uploads. Containers that do not default the request encoding — including Eclipse Jetty, WildFly (Undertow) and GlassFish — previously failed every multipart upload with IllegalArgumentException: Null charset name. Apache Tomcat was unaffected, as it defaults the request encoding to UTF-8.

December 2025

1.4.4

Released Dec 10, 2025
Full Version: 
1.3.10-struts-1.4.4

Notes

  • struts-tiles removed its dependency on commons-io, as it is no longer required.
  • struts-core now uses a more efficient implementation for its security-related regular expression.

September 2025

1.4.3

Released Sep 12, 2025
Full Version: 
1.3.10-struts-1.4.3

Notes

  • Added sources jar to the published artifacts.

August 2025

1.4.2

Released Aug 25, 2025
Full Version: 
1.3.10-struts-1.4.2

Notes

  • updates to struts-faces to fully support Jakarta EE 9

1.4.1

Released Aug 4, 2025
CVE-2025-54656
CVE-2025-48976
CVE-2025-48734
Full Version: 
1.3.10-struts-1.4.1

Security Fixes

This release patches the following:

  • CVE-2025-54656: Improper Output Neutralization for Logs Vulnerability
  • CVE-2025-48976: FileUpload DoS via part headers
  • CVE-2025-48734: Improper Access Control vulnerability
    • Dependency upgrade of beanutils to 1.11.0 or override to nes-v1.7.4 addresses this vulnerability.

Dependency Upgrades

  • commons-beanutils:commons-beanutils 1.9.4 -> 1.11.0
  • org.apache.commons:commons-fileupload2-core 2.0.0-M1 -> 2.0.0-M4
  • org.apache.commons:commons-fileupload2-jakarta 2.0.0-M1 -> commons-fileupload2-jakarta-servlet5 2.0.0-M4

June 2025

1.4.0

Released Jun 25, 2025
Full Version: 
1.3.10-struts-1.4.0

Notes

  • This release originates from NES for Apache Struts 1.3.x and is designed to be compatible with Jakarta EE environments.

Dependency Upgrades

  • commons-fileupload 2.0.0-M1
  • Jakarta EE 9 compatibility:
    • jakarta.faces-api 3.0.0
    • jakarta.servlet-api 5.0.0
    • jakarta.servlet.jsp-api 3.0.0
    • jakarta.el-api 4.0.0 Full Version: 1.3.10-struts-1.4.0

Stay in the loop

~/herodevs-spring-framework-support

Open Source Support

When official support ends, we're just getting started.